Unable to disable diskaccess

[yuriwoof]

Describe the bug

Unable to update manage disk with "AllowAll" property.
I can change this from Azure portal.

$ az disk show -g lablinux -n rhel9_DataDisk_0 --query "diskAccessId"
"/subscriptions/93b7ca88-d2cc-4381-97ec-f99f3a702495/resourceGroups/LABWIN/providers/Microsoft.Compute/diskAccesses/diskaccess2"
$ az disk update -g lablinux -n rhel9_DataDisk_0 --network-access-policy AllowAll
(ConflictingUserInput) Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
Code: ConflictingUserInput
Message: Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate

Related command

$ az disk update -g lablinux -n rhel9_DataDisk_0 --network-access-policy AllowAll

Errors

$ az disk update -g lablinux -n rhel9_DataDisk_0 --network-access-policy AllowAll
(ConflictingUserInput) Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
Code: ConflictingUserInput
Message: Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate

Issue script & Debug output

urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "PUT /subscriptions/93b7ca88-d2cc-4381-97ec-f99f3a702495/resourceGroups/lablinux/providers/Microsoft.Compute/disks/rhel9_DataDisk_0?api-version=2023-04-02 HTTP/1.1" 400 156
cli.azure.cli.core.sdk.policies: Response status: 400
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '156'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-resource': 'Microsoft.Compute/CreateUpdateDisks3Min;2998,Microsoft.Compute/CreateUpdateDisks30Min;24997'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'x-ms-served-by': 'daeafd9c-6b88-488d-b259-3c296af1eba2_133531330085316196'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'ae4c7861-03b5-4b36-9795-44fb0c1c3023'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-writes': '1199'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'd7dfa704-fb35-4f61-a51a-cc26f46b33e1'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'JAPANEAST:20240306T051215Z:d7dfa704-fb35-4f61-a51a-cc26f46b33e1'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 9952A6592A0544A5B5F3A1EB8ED3C0A8 Ref B: TYO01EDGE1111 Ref C: 2024-03-06T05:12:15Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 06 Mar 2024 05:12:15 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {
"error": {
"code": "ConflictingUserInput",
"message": "Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate"
}
}
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.9/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 664, in execute
raise ex
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 731, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 701, in _run_job
result = cmd_copy(params)
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 334, in call
return self.handler(*args, **kwargs)
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/command_operation.py", line 242, in handler
result = cached_put(self.cmd, setter, setterargs[self.setter_arg_name],
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 453, in cached_put
return _put_operation()
File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 447, in _put_operation
result = operation(**kwargs)
File "/usr/lib64/az/lib/python3.9/site-packages/azure/core/tracing/decorator.py", line 76, in wrapper_use_tracer
return func(*args, **kwargs)
File "/usr/lib64/az/lib/python3.9/site-packages/azure/mgmt/compute/v2023_04_02/operations/_operations.py", line 1454, in begin_create_or_update
raw_result = self._create_or_update_initial(
File "/usr/lib64/az/lib/python3.9/site-packages/azure/mgmt/compute/v2023_04_02/operations/_operations.py", line 1325, in _create_or_update_initial
raise HttpResponseError(response=response, error_format=ARMErrorFormat)
azure.core.exceptions.HttpResponseError: (ConflictingUserInput) Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
Code: ConflictingUserInput
Message: Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate

cli.azure.cli.core.azclierror: (ConflictingUserInput) Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
Code: ConflictingUserInput
Message: Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
az_command_data_logger: (ConflictingUserInput) Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
Code: ConflictingUserInput
Message: Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f8a42f99f70>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 1.328 seconds (init: 0.089, invoke: 1.239)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 3968 in cache
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/usr/bin/python3.9 /usr/lib/az/lib/python3.9/site-packages/azure/cli/telemetry/init.py /home/yurio/.azure"
telemetry.process: Return from creating process
telemetry.main: Finish creating telemetry upload process.

Expected behavior

Able to change disk access from private to public

Environment Summary

"azure-cli": "2.58.0",
"azure-cli-core": "2.58.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"vm-repair": "1.0.0b1"

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[yanzhudd]

Hi @yuriwoof
does this issue only occur in the 2.58.0 version of CLI or also in the previous versions?

[yuriwoof]

az disk update -g lablinux -n rhel9_DataDisk_0 --network-access-policy AllowAll

@yanzhudd
yes, this can be reproduced in 2.57.0 and 2.56.0 as well.

[Diofe]

Hi @yuriwoof

To avoid the error "Message: Disk Access is only supported for disks with NetworkAccessPolicy AllowPrivate" when run the command:
$ az disk update -g lablinux -n rhel9_DataDisk_0 --network-access-policy AllowAll

you can run the command bellow:
az disk update --name --resource-group --set diskAccessId="null" networkAccessPolicy=AllowAll publicNetworkAccess=Enabled

This work for version:
[ ~ ]$ az --version
azure-cli 2.61.0

core 2.61.0
telemetry 1.1.0

Extensions:
ai-examples 0.2.5
ml 2.26.0
ssh 2.0.3

Dependencies:
msal 1.28.0
azure-mgmt-resource 23.1.1

Python location '/usr/bin/python3.9'
Extensions directory '/home//.azure/cliextensions'
Extensions system directory '/usr/lib/python3.9/site-packages/azure-cli-extensions'

Python (Linux) 3.9.19 (main, Mar 28 2024, 18:56:59)
[GCC 11.2.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.
[ ~ ]$